Analysis
-
max time kernel
10s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-09-2024 15:53
General
-
Target
fedb0d11871fcf808c83357a2ab983de_JaffaCakes118.exe
-
Size
630KB
-
MD5
fedb0d11871fcf808c83357a2ab983de
-
SHA1
15079b89858512b004f9c750dd53a9901997e137
-
SHA256
ab9812f1943e549bfb06afd112b82e15e34a3a9721dd7443fc7380b61bf0092f
-
SHA512
422d915d50834ee30f8078d3143f0746fa124d9fe52e5a01a7c19afd65fa49408644a5bd54117b42a274666ad751eab97f62f0a685a2cff16b59d9fe1e333927
-
SSDEEP
12288:y3TdtLW5WIj1YSSdFx+vBSXyMzBUWb9lx/9AgHLo8OW+rBYat:MDsj1dEOBcJ9nPx/igrp+Vt
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fedb0d11871fcf808c83357a2ab983de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fedb0d11871fcf808c83357a2ab983de_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\svchost.exeC:\Windows\system32\28463\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.6MB
MD567e6e37998718f746ba52eaf94c4c0a7
SHA183e7abe8c919c75660b4f7e327dae54a92064bb1
SHA2561dc68c7eb3fc39e118521c7425c47da841283a076cc422a480bf9ef637c43000
SHA51221521aac07b47a3386dd789a5ccdbe0175799dfbfe5758670a35a6b642b89578ecfaa4e0086dfe3b734bce1af317671339aa2f5650705ac317b182c01c193f3c
-
Filesize
2KB
MD5c427f41a9eb12166c278da8fed8a0c4a
SHA1e0e1d1c8f6b58675a544f1461997cfc37a2e6c63
SHA256ee74d1ba7e74e916f57ac4134aa5aa6eb7f920e7dae3b4cdb75af9225da616c6
SHA512ea2e49983e04afaa0eec5b28eeed1e9c804326b49933e69962805c10a405cb7dd87061e50355f395e74107cb6ca674d4c8c0000ef13505ec58b1d7dec873aa85
-
Filesize
513KB
MD50c7a714b8e1d2ead2afc90dcc43bbe18
SHA166736613f22771f5da5606ed8c80b572b3f5c103
SHA256800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e
SHA51235db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4
-
Filesize
2B
MD5e0aa021e21dddbd6d8cecec71e9cf564
SHA19ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA256565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
SHA512900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
-
Filesize
630KB
MD5fedb0d11871fcf808c83357a2ab983de
SHA115079b89858512b004f9c750dd53a9901997e137
SHA256ab9812f1943e549bfb06afd112b82e15e34a3a9721dd7443fc7380b61bf0092f
SHA512422d915d50834ee30f8078d3143f0746fa124d9fe52e5a01a7c19afd65fa49408644a5bd54117b42a274666ad751eab97f62f0a685a2cff16b59d9fe1e333927
-
Filesize
40KB
MD503ebc053c8eec6b4f4afbbb5dc64b169
SHA19ed172dbce1a6a1dd20e08a9720afba210eee79c
SHA256ad25714f5c7eb2e27742b5e0886e865fc8884e8b65cb863d2aeba0c6dbff2d02
SHA51240eab99574ea6614341b869239b014a74cdc24da0c4be69681eaab18de72bbef14ad4cf36215e39eff4978b8ed074762ce25bb85a042219ac5db5cb46390e9ff
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
84KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
84KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
4KB